AWS Organizations

AWS Organizations groups many AWS accounts under one management account, so policies, billing and service delegation are set once for all of them. The AWS Baseline uses it to create every account it needs and to keep the rules that apply to them in one place.

What it does

An AWS account is a boundary: it has its own resources, its own identities and its own bill. Organizations joins accounts into a tree. The management account sits at the root and owns the organization. Member accounts are grouped into organizational units (OUs), folders that policies attach to. A policy attached to an OU applies to every account inside it.

Two policy types matter here. Service control policies (SCPs) set the maximum permissions any identity in a member account can have. Tag policies define which tag keys and values are allowed. Organizations also lets the management account name a delegated administrator for a service, so the day-to-day operation of GuardDuty or IAM Identity Center happens in a member account instead of the management account.

How BuiltForProd uses it

The organizations unit of the AWS Baseline (definition units/organizations, module modules/organizations, listed by the core/root/global stack file) creates the organization and everything attached to it:

• Fourteen accounts: the management account core-root, nine core-* shared-service accounts and four plat-* workload accounts, each created from a static map with a root email of the form aws+acme-core-audit@company.com.
• Two OUs, core and plat, with three consolidated SCPs attached to both (see Service control policies).
• One tag policy that pins the keys every unit applies through provider default tags (Namespace, Environment, Stage, ManagedBy, Repository). It reports only; enforce_tag_policy = false until the compliance report is clean.
• Delegated administrators: core-identity for IAM Identity Center, core-audit for AWS Config, and core-security as the Firewall Manager administrator. GuardDuty, Security Hub, Inspector and Macie are delegated to core-security by their own units.
• Trusted service access for those services, so they can see every account.

Account creation is phased. The unit ships with enable_accounts = false, which creates the organization, OUs and SCPs first; the member accounts follow once the account quota is raised. After every apply, a hook writes org_accounts.hcl, the account-id map that root.hcl reads to target each account.

The management account is kept for Organizations, billing, the state backend and the organization CloudTrail. SCPs do not apply to it, so human access there is limited to Platform Leads through a separate permission set in IAM Identity Center, switched on only after the SSO groups exist.

Terms you will see

Term	Meaning
Management account	The account that owns the organization; core-root in the AWS Baseline.
Member account	Any other account in the organization.
Organizational unit (OU)	A folder of accounts that policies attach to; core and plat here.
Service control policy (SCP)	A permission ceiling for a whole OU; it restricts, it never grants.
Tag policy	Rules for allowed tag keys and values, reported or enforced.
Delegated administrator	A member account allowed to run a service for the whole organization.
Trusted access	Permission for an AWS service to operate across every account.

Where to read more

• AWS Baseline overview for how the accounts fit together.
• Service control policies for the three policies attached to the OUs.
• STS and role assumption for how pipelines reach each account.